StackRadar

CVE-2026-3949

Medium

Advisory

Published 11 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
338
of 17,781 indexed, latest versions
Container images
222
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 338 of 17,781 indexed charts deploy, on 222 images.

Affected packageAffected versionsFixed inImages
libheifdeb1.15.1-1, 1.15.1-1+deb12u1, 1.19.8-1, 1.19.8-1+deb13u1no fix listed222
OSV records
DEBIAN-CVE-2026-3949

Charts affected

338 by stars
ChartLatestAffected imagesRadar Score
appcnapVerified publisher1.2.01 of 1See more

app cnap 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
genericcolearendt0.2.71 of 1See more

generic colearendt 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

14,559
rtcsic-charts0.1.11 of 5See more

rt csic-charts 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
firefart/requesttracker:5.0.40d6249906d8c
libheif@1.15.1-1
no fix listed

Open the chart page →

15,380
cypikcypik-app0.1.02 of 2See more

cypik cypik-app 0.1.0

2 of the 2 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed
library/nginx:1.25a484819eb602
libheif@1.15.1-1
no fix listed

Open the chart page →

7,503
view-cadvisorcypik-helm-chart0.1.01 of 1See more

view-cadvisor cypik-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
nginx-chartdaeho12Verified publisher0.1.01 of 1See more

nginx-chart daeho12 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
damap-chartdamapVerified publisher0.3.01 of 5See more

damap-chart damap 0.3.0

1 of the 5 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
ghcr.io/damap-org/damap-frontend:5.0.1609f48af4efc
libheif@1.19.8-1
no fix listed

Open the chart page →

13,936
helm-chart-testdasmeta0.1.41 of 1See more

helm-chart-test dasmeta 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
db-connection-testdb-connection-testVerified publisher0.1.01 of 1See more

db-connection-test db-connection-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
felipecs8/app-db-connection-test:v129e06c9c6385
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

10,090
linkdingdeimosfr-charts1.0.31 of 1See more

linkding deimosfr-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.35.00c5dddf0b37c
libheif@1.15.1-1
no fix listed

Open the chart page →

6,075
my-helm-chartdemohelm20.1.01 of 1See more

my-helm-chart demohelm2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

68,240
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

68,240
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

7,459
webtreesdjjudas21Verified publisher3.0.01 of 1See more

webtrees djjudas21 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
libheif@1.19.8-1
no fix listed

Open the chart page →

5,966
wizarrdjjudas21Verified publisher0.1.51 of 1See more

wizarr djjudas21 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
libheif@1.15.1-1
no fix listed

Open the chart page →

14,627
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-frontend:k8s8e53861be292
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

10,270
rundeckdwardu-helm-charts0.3.41 of 2See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

19,802
iotaeclipse-aeriosVerified publisher1.0.21 of 4See more

iota eclipse-aerios 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
eclipseaerios/iota-messages-api:lateste7f5ba0bc64d
libheif@1.19.8-1
no fix listed

Open the chart page →

13,391
kube-ecp-stackemqx-operator2.5.11 of 16See more

kube-ecp-stack emqx-operator 2.5.1

1 of the 16 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
emqx/ecp-ui:2.5.1e33e9816f147
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

23,685
nginx-charteoc-chartsVerified publisher2.0.01 of 1See more

nginx-chart eoc-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
wordpresseoc-chartsVerified publisher0.14.41 of 1See more

wordpress eoc-charts 0.14.4

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/wordpress:6.8.3-apache30bff39330d1
libheif@1.19.8-1
no fix listed

Open the chart page →

7,233
powfaucetethereum-helm-chartsVerified publisher1.2.11 of 1See more

powfaucet ethereum-helm-charts 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
pk910/powfaucet:v2-stable3dcae6a62896
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

4,456
beeport-uiethersphereVerified publisher0.76.22 of 3See more

beeport-ui ethersphere 0.76.2

2 of the 3 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed
library/node:ltsbe23f54a88d3
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

7,368
multichain-uiethersphereVerified publisher0.73.12 of 3See more

multichain-ui ethersphere 0.73.1

2 of the 3 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed
library/node:ltsbe23f54a88d3
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

7,368
static-siteethersphereVerified publisher0.73.12 of 2See more

static-site ethersphere 0.73.1

2 of the 2 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed
library/node:latestf5d1cc40abc1
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

6,851
ferriscompanyferriscompany0.1.01 of 1See more

ferriscompany ferriscompany 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
ghcr.io/libreconnect/ferriscompany:0.1.0-rc6ed86db9f0efe
libheif@1.15.1-1
no fix listed

Open the chart page →

10,741
fineractfineract-openshift0.1.11 of 4See more

fineract fineract-openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

7,792
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

64,489
scanservjsgabe565Verified publisher0.9.21 of 1See more

scanservjs gabe565 0.9.2

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
libheif@1.15.1-1
no fix listed

Open the chart page →

13,241
icinga2geek-cookbookVerified publisher4.2.01 of 1See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
jordan/icinga2:latestf75025fe8ea8
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

9,077
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

12,958
goofy-chartgoofy-chart0.1.01 of 1See more

goofy-chart goofy-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-imageprovider4e322858fe56
libheif@1.15.1-1
no fix listed

Open the chart page →

49,025
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

15,722
video-analytics-demo-l4tgpu-operator0.1.31 of 3See more

video-analytics-demo-l4t gpu-operator 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
web-charthcpark-ktcloudlab0.1.01 of 1See more

web-chart hcpark-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
heliconehelicone0.1.421 of 14See more

helicone helicone 0.1.42

1 of the 14 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
helicone/supabase-migration-runner:v2025.03.05-14a913936c97b
libheif@1.15.1-1
no fix listed

Open the chart page →

24,995
test-apphellnet0.1.11 of 1See more

test-app hellnet 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
hello-worldhello-world-pponyVerified publisher0.3.01 of 1See more

hello-world hello-world-ppony 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:1.25.49ff236ed47fe
libheif@1.15.1-1
no fix listed

Open the chart page →

5,839
hello-world-charthelm-chart-test-hello-world0.1.01 of 1See more

hello-world-chart helm-chart-test-hello-world 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
my-apphelm-demo85640.2.71 of 2See more

my-app helm-demo8564 0.2.7

1 of the 2 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
chart-bookhelm-deploy-book0.1.01 of 3See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
dannielkil/book-frontend:latest937993927694
libheif@1.15.1-1
no fix listed

Open the chart page →

9,122
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
libheif@1.19.8-1
no fix listed

Open the chart page →

10,849
dawarichhelmforgeVerified publisher1.0.01 of 4See more

dawarich helmforge 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
postgis/postgis:18-3.67e00e8c3539f
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

4,742
entehelmforgeVerified publisher1.0.21 of 4See more

ente helmforge 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
ghcr.io/ente/web:5ab0c5b4c7a89c4e470ef6f793600da33cebf35d3f4864eb7f11
libheif@1.19.8-1
no fix listed

Open the chart page →

4,201
generichelmforgeVerified publisher3.1.51 of 1See more

generic helmforge 3.1.5

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
library/nginx:1.31.505b8cb60c354
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,827
myapphelmingapp0.1.01 of 1See more

myapp helmingapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
muhammedgamal/fp23:latest74b4cd69b6fa
libheif@1.15.1-1
no fix listed

Open the chart page →

12,607
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-3949.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

25,017

Container images carrying it

222 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
libheif@1.15.1-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
libheif@1.19.8-1
no fix listed
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
libheif@1.15.1-1+deb12u1
no fix listed
1
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
libheif@1.19.8-1+deb13u1
no fix listed
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
libheif@1.15.1-1+deb12u1
no fix listed
1
ghcr.io/wittdennis/calibre-web:1.1.1aa7d5d5dd6be
libheif@1.15.1-1+deb12u1
no fix listed
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
libheif@1.15.1-1
no fix listed
1
ghcr.io/zammad/zammad:7.1.3-0011e65123a43ecc
libheif@1.19.8-1+deb13u1
no fix listed
1
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
libheif@1.15.1-1+deb12u1
no fix listed
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
libheif@1.15.1-1+deb12u1
no fix listed
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/jtekt-corporation/image-storage-service-gui:v1.9.434823c8abe00
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/jtekt-corporation/shinsei-manager-front:v1.5.5f8fb4eea4071
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
libheif@1.15.1-1+deb12u1
no fix listed
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
libheif@1.15.1-1
no fix listed
1
quay.io/mittwald/kube-httpcache:stable2169032c5840
libheif@1.15.1-1+deb12u1
no fix listed
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
libheif@1.15.1-1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
libheif@1.19.8-1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
libheif@1.15.1-1+deb12u1
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
libheif@1.15.1-1+deb12u1
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.